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GAO 


United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


Resources,  Community,  and 
Economic  Development  Division 

B-221179.10 

March  25, 1991 

The  Honorable  John  Glenn 
Chairman,  Committee  on  Governmental 
Affairs 

United  States  Senate 
Dear  Mr.  Chairman: 

Foreign  ownership,  control,  or  influence  (foci)  over  a  U.S.  company  that 
performs  classified  work  for  the  Department  of  Energy  (doe)  presents  a 
national  security  threat  because  of  the  potentially  uncontrolled  transfer 
of  nuclear  weapons-related  technology  or  material  to  foreign  entities.  In 
May  1990,  we  agreed  with  your  office  to  examine  whether  doe  and  its 
Lawrence  Livermore,  Los  Alamos,  and  Sandia  weapons  laboratories  had 
complied  with  doe’s  regulations  and  procedures  designed  to  protect  the 
United  States  against  such  a  risk  when  they  awarded  classified  con¬ 
tracts — contracts  that  require  access  to  classified  information  or  signifi¬ 
cant  quantities  of  special  nuclear  materials  as  defined  in  10  C.F.R.  part 
710. 


Results  in  Brief 


Overall,  neither  doe  nor  its  government-owned  contractor-operated 
weapons  laboratories  fully  complied  with  doe’s  regulations  and  proce¬ 
dures  for  determining  whether  contractors  are  subject  to  foreign  inter¬ 
ests  and  for  preventing  associated  risks.  We  estimated  that  about  98 
percent  of  the  classified  contracts  awarded  at  the  weapons  laboratories 
from  October  1987  through  March  1990  that  were  subject  to  foci  proce¬ 
dures  did  not  fully  comply  with  those  procedures.  In  addition,  none  of 
doe’s  eight  field  operations  offices  completely  complied  with  foci  proce¬ 
dures  when  awarding  existing  management  and  operating  contracts  for 
operation  of  doe’s  major  research,  production,  and  weapons  facilities. 

In  addition  to  compliance  problems,  we  found  weaknesses  in  the  regula¬ 
tions  doe  uses  to  determine  whether  contractors  are  subject  to  foci. 
Notably,  the  regulations  require  that  national  security  determinations 
be  made  by  doe’s  contracting  officers  rather  than  doe’s  safeguards  and 
security  officials;  the  latter,  however,  are  in  a  better  position  to  make 
such  determinations.  We  also  found  that  a  number  of  doe’s  foci  require¬ 
ments  are  burdensome.  In  addition,  some  of  doe’s  regulations  are  incon¬ 
sistent  with  those  used  by  the  Department  of  Defense  (dod)  to  determine 
whether  dod  contractors  are  subject  to  foci.  This  inconsistency  has 
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caused  confusion  among  contractors  that  do  classified  work  with  both 
doe  and  dod. 

Finally,  doe  has  several  internal  control  weaknesses  that  could  cause 
further  problems  in  safeguarding  classified  matter.  For  example,  all 
three  of  doe’s  weapons  laboratories  lacked  data  systems  that  could  accu¬ 
rately  identify  all  classified  contracts. 


Background 


In  February  1984,  doe  amended  its  procurement  regulations  to  obtain 
information  on  whether  certain  doe  contractors  are  owned,  controlled, 
or  influenced  by  foreign  individuals,  governments,  or  organizations  and 
whether  that  foreign  involvement  might  pose  an  undue  risk  to  national 
security.  Effective  March  30, 1984,  doe  began  requiring  certain  entities 
to  complete  a  questionnaire  containing  1 1  questions  on  the  degree  and 
type  of  their  foreign  interests;  this  requirement  applies  to  those  prospec¬ 
tive  contractors,  subcontractors,  and  their  parent  or  holding  companies 
that  would  have  access  to  classified  information  and/or  to  significant 
quantities  of  special  nuclear  material,  doe  Office  of  Safeguards  and 
Security  (OSS)  officials  are  required  to  review  the  questionnaire  and  con¬ 
sult  with  the  doe  contracting  officer  before  the  contract  is  awarded. 
According  to  oss’  foci  procedures,  if  a  prospective  contractor  responds 
positively  to  one  or  more  questions — disclosing  that  the  entity  has  iden¬ 
tified  a  foreign  interest — the  questionnaire  is  reviewed  by  oss  at  doe 
headquarters.  If  the  answer  to  all  1 1  questions  is  “no,” — signifying  that 
the  entity  may  have  undisclosed  foreign  interests — then  oss  delegates 
its  review  to  the  cognizant  field  safeguards  and  security  division  at  the 
doe  operations  office  responsible  for  security  oversight  of  the  prospec¬ 
tive  contractor. 

doe’s  procurement  regulations  state  that  no  classified  contract  can  be 
awarded  until  doe’s  contracting  officer,  after  consulting  with  oss,  deter¬ 
mines  that  the  award  will  not  pose  an  undue  risk  to  the  common  defense 
and  security  of  the  United  States.  If  an  undue  risk  may  exist,  the  pro¬ 
spective  contractor  must  submit  a  plan  of  action  to  prevent  foreign 
access  to  the  classified  matter.  If  the  contractor  cannot  provide  a  plan 
acceptable  to  doe,  then  the  contractor  cannot  be  considered  for  contract 
award  and  affected  existing  contracts  must  be  terminated. 
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FOCI  Compliance  and 
Oversight  by  DOE’s 
Operations  Offices 
Were  Inadequate 


doe’s  weapons  laboratories  and  operations  offices  did  not  adequately 
comply  with  doe’s  foci  regulations  before  they  awarded  classified  con¬ 
tracts.  This  was  due,  in  part,  to  weak  oversight  and/or  misinterpreta¬ 
tions  of  the  foci  regulations  by  doe’s  Albuquerque  and  San  Francisco 
Operations  Offices. 

We  reviewed  a  stratified  random  sample  of  293  contracts  from  a  uni¬ 
verse  of  503  contracts  awarded  by  the  three  weapons  laboratories  from 
October  1987  through  March  1990  that  had  been  identified  as  possibly 
subject  to  foci  procedures.  On  the  basis  of  this  review,  we  estimate  that 
about  79  percent  were  subject  to  foci  reviews,  and  of  these  contracts 
about  98  percent  had  been  awarded,  without  the  laboratories’  fully  com¬ 
plying  with  doe’s  foci  regulations  and/or  procedures  designed  to  protect 
classified  matter.  For  example,  none  of  the  laboratories  had  contacted 
doe’s  contracting  officers  at  the  cognizant  doe  operations  offices  before 
awarding  contracts  to  companies  that  answered  “no”  to  all  foci  ques¬ 
tions.  As  a  result,  these  contracts  were  awarded  without  the  laborato¬ 
ries’  obtaining  the  required  doe  contracting  officer  determination  that 
no  undue  risk  to  national  security  existed.  Further,  some  classified  con¬ 
tracts  were  awarded  without  completion  of  the  foci  form.  We  estimate 
that  for  about  15  percent  of  the  classified  contracts,  the  contractor  did 
not  complete  the  required  foci  questionnaire.  In  addition,  contrary  to 
doe  regulations,  none  of  the  three  laboratories  required  individual  con¬ 
sultants  performing  classified  work  to  disclose  foreign  interests. 

doe’s  Albuquerque  Operations  Office,  which  is  responsible  for  over¬ 
seeing  day-to-day  operations  at  Sandia  and  Los  Alamos,  was  lax  in 
enforcing  and  following  foci  procedures.  For  example,  although  doe’s 
foci  regulations  took  effect  in  March  1984,  which  was  6  months  after 
doe  awarded  a  5-year  management  and  operating  contract  to  operate 
Sandia,  doe’s  Albuquerque  office  did  not  add  foci  requirements  to 
Sandia’s  contract  until  the  contract  was  renewed  in  late  1988.  doe  Albu¬ 
querque  officials  told  us  that  it  was  an  oversight  not  to  require  Sandia  to 
follow  foci  procedures  sooner. 

We  also  found  misinterpretations  of  foci  regulations  and/or  procedures 
on  the  part  of  doe  officials  at  the  laboratories  and  operations  offices. 

For  example,  although  Sandia  officials  were  required  to  comply  with 
doe’s  foci  regulations  under  the  provisions  of  its  1988  contract  renewal, 
in  June  1989,  doe  Albuquerque  officials  approved  purchasing  instruc¬ 
tions  used  by  Sandia  laboratory  officials  to  implement  the  new  require¬ 
ments  which  were  contrary  to  doe’s  foci  regulations.  The  instructions 
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did  not  require  the  doe  Albuquerque  contracting  officer  to  make  a  for¬ 
eign  interest  determination  in  those  cases  where  the  contractor  had  com¬ 
pleted  the  questionnaire  with  all  “no”  responses. 

Similarly,  doe’s  Albuquerque  management  staff  issued  supplemental 
foci  guidance  in  October  1989  that  was  contrary  to  doe’s  foci  regulations 
and  oss  procedures  and  to  the  provisions  of  its  1988  contract  renewal; 
those  provisions  require  each  classified  contract  to  have  a  completed 
questionnaire.  For  example,  the  guidance  incorrectly  stated  that  once  a 
foci  questionnaire  has  been  submitted  by  the  prospective  contractor  and 
parent  company,  no  additional  foci  questionnaire  needs  to  be  completed 
for  other  contracts  with  that  company.  When  we  notified  doe  Albu¬ 
querque  officials  of  these  inconsistencies,  they  stated  that  the  guidance 
was  issued  in  error  and  rescinded  it  as  of  December  17, 1990. 

Inadequate  foci  compliance  efforts  were  not  limited  to  doe’s  Albu¬ 
querque  and  San  Francisco  offices.  All  eight  of  doe’s  operations  offices 
did  not  fully  comply  with  foci  regulations  and/or  procedures  when 
awarding  long-term  management  and  operating  contracts  to  companies 
that  operate  doe’s  major  facilities.  Of  the  37  awarded  from  March  1985 
through  December  1989  that  required  foci  compliance,  we  found  that 
29,  or  78  percent,  were  not  in  compliance  for  one  or  more  reasons.  For 
example,  we  found  no  foreign  interest  disclosure  questionnaire  for  15 
contracts  and  no  parent  company  foreign  interest  disclosure  for  6 
contracts. 


DOE’s  FOCI 
Regulations  Need 
Strengthening  and 
Streamlining 


doe’s  foci  regulations  are  not  adequate  because  (1)  the  staff  in  the  best 
position  to  know  is  not  making  the  foci  security  determinations,  (2)  sep¬ 
arate  determinations  are  required  for  each  new  contract  or  modification, 
and  (3)  the  regulations  are  inconsistent  with  those  of  most  other  federal 
agencies. 


FOCI  Determination 
Authority  Resides  With 
Contracting  Instead  of 
Security  Personnel 


Under  doe’s  acquisition  regulations,  foci  determinations  are  made  by 
contracting  officers — individuals  generally  not  well  versed  in  security 
matters — rather  than  safeguards  and  security  officials,  who  are  in  a 
better  position  to  make  such  judgments.  This  practice  can  increase 
security  risks,  especially  if  the  contracting  officer  fails  to  consult  with 
oss  officials  as  required.  For  example,  the  doe  Contracts  and  Procure¬ 
ment  Division  at  Albuquerque,  contrary  to  doe  regulations,  did  not 
require  its  contracting  officers  to  consult  with  safeguards  and  security 
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officials  for  those  contractors  indicating  no  foreign  interests — all  “no” 
responses  to  the  foci  questionnaire.  According  to  a  senior  division  offi¬ 
cial,  in  such  cases,  no  foci  determination  by  a  contracting  officer  is 
required;  therefore,  no  consultation  is  needed.  When  we  notified  this 
official  that  this  policy  is  inconsistent  with  doe’s  regulations,  he  stated 
that  Albuquerque  would  immediately  start  to  require  its  contracting 
officers  to  consult  with  safeguards  and  security  officials  for  all  classi¬ 
fied  contracts  with  contractors  indicating  no  foreign  interests  on  the 
form. 


DOE’s  Regulations  Are 
Burdensome  and 
Inconsistent  With  Those  of 
Most  Other  Federal 
Agencies 


According  to  an  Albuquerque  Operations  Office  internal  memorandum, 
fully  implementing  doe’s  foci  regulations  for  every  classified  contract 
would  significantly  impede  future  contract  actions  by  burdening  doe  and 
Sandia  with  extensive  (and  somewhat  needless)  paperwork.  Also, 
according  to  a  doe  Office  of  General  Counsel  official,  the  doe  require¬ 
ment  for  a  separate  foci  determination  for  each  contract  modification 
seems  excessive.  We  noted  that  many  doe  contractors  have  more  than 
one  contract  with  doe,  and  numerous  contracts  are  modified  several 
times — We  found  one  contract  awarded  in  1984  with  25  modifications. 

In  addition,  each  classified  contract  requires  the  company  to  report  foci- 
related  changes  immediately  to  doe.  Therefore,  we  question  the  need  for 
a  separate  determination  each  time  a  contract  is  modified  or  awarded  to 
a  company  already  having  a  classified  contract  with  doe. 


The  problems  stemming  from  multiple  classified  contracts  and 
numerous  contract  modifications  are  less  likely  to  occur  under  dod’s  foci 
procedures,  which  are  used  by  20  other  federal  agencies,  including  the 
National  Aeronautics  and  Space  Administration;  the  Environmental  Pro¬ 
tection  Agency;  the  Departments  of  State,  Commerce,  and  the  Treasury; 
and  gao.  dod’s  foci  process  is  not  associated  with  specific  contract 
awards,  but  is  part  of  a  contractor  facility  security  clearance  program.1 
dod  requires  its  contractors  to  complete  a  new  foci  questionnaire  (1) 
when  any  significant  change  occurs  in  the  information  previously  sub¬ 
mitted,  (2)  every  5  years  from  the  date  of  the  last  change  submitted 
when  any  question  has  been  answered  yes,  and  (3)  whenever  advised 
that  the  form  is  required  for  an  official  purpose. 


According  to  laboratory  and  doe  officials,  contractors  doing  classified 
work  with  both  doe  and  dod  question  why  doe  does  not  accept  a  dod 


1  AD  DOD  or  DOE  contractor  facilities  must  have  an  approved  security  clearance  before  permitting 
classified  matter  on  the  premises. 
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determination  that  no  security  risk  exists  when  it  awards  or  modifies  a 
contract.  Both  the  doe  and  dod  foci  questionnaires  are  almost  identical, 
except  that  the  dod  questionnaire  requires  more  complete  disclosure. 
dod  reviews  are  in  some  ways  more  complete  than  those  at  doe.  For 
example,  dod  requests  foci  information  for  all  parent  companies,  not 
only  the  ultimate  parent  company,  doe  officials  told  us  in  December 
1990  that  they  had  recently  started  to  review  selected  dod  foci  determi¬ 
nations  to  ascertain  whether  they  satisfy  doe  requirements. 


Internal  Control 
Weaknesses 
Contributed  to 
Potential  Security 
Problems 


During  our  review  of  doe’s  foci  controls,  we  found  the  following  internal 
control  weaknesses:  (1)  no  efficient  system  to  identify  all  classified  con¬ 
tracts;  (2)  no  written  guidelines  for  making  determinations;  and  (3)  defi¬ 
ciencies  with  the  foci  questionnaire,  such  as  obtaining  relevant 
information  from  individual  consultants.  These  weaknesses  increase  the 
risk  that  classified  matter  could  be  made  available  to  contractors  that 
are  owned,  controlled,  or  influenced  by  foreign  governments,  individ¬ 
uals,  or  organizations. 


Lack  of  Information  on  the 
Number  of  Classified 
Contracts  Awarded 


All  three  weapons  laboratories  could  not  readily  identify  all  classified 
contracts  awarded  at  their  facilities.  Although  Livermore  and  Sandia 
maintained  computerized  systems  designed  to  identify  all  classified  con¬ 
tracts  awarded  at  each  facility,  data  in  these  systems  were  incomplete. 
In  addition,  Los  Alamos  did  not  have  a  data  system  designed  to  identify 
such  contracts.  The  following  are  examples  of  these  problems: 


•  Livermore  officials  provided  us  a  list  of  82  classified  contracts  awarded 
from  October  1987  through  July  1990.  Twenty-eight  of  the  82  were 
identified  using  the  laboratory’s  computerized  procurement  data 
system,  and  the  remaining  54  were  identified  by  a  manual  search  of 
Livermore’s  security  files.  Using  other  sources,  including  information 
found  in  the  contract  files,  we  identified  an  additional  20  classified  con¬ 
tracts  that  were  not  on  Livermore’s  original  list. 

•  Sandia  officials,  using  their  computerized  system,  provided  us  a  list  of 
451  classified  contracts  awarded  from  October  1, 1987,  through  March 
31, 1990.  We  identified  an  additional  27  classified  contracts  that  were 
not  included  in  Sandia’s  procurement  data  system. 

•  Los  Alamos  officials  provided  us  a  list  of  362  contracts  that  they  said 
possibly  involved  classified  matter.  To  determine  whether  a  contract  on 
the  list  required  access  to  classified  matter,  we  had  to  review  the  con¬ 
tract  file.  Fifty-seven  of  108  contracts  we  reviewed  were  classified. 


Page  6 


GAO/RCED-91-83  Better  Foreign-Interest  Controls  Are  Needed 


B-221179.10 


Without  a  reliable  system  that  can  identify  individual  classified  con¬ 
tracts,  doe  cannot  ensure  that  its  controls  for  preventing  foreign  access 
to  classified  information  or  material  are  effective.  We  discussed  these 
problems  with  officials  at  each  of  the  weapons  laboratories.  At 
Livermore,  we  were  told  that  the  most  likely  cause  of  incomplete  data 
was  an  error  in  completing  the  form  used  to  enter  data  into  the  system. 
At  Sandia,  we  were  told  that  most  of  the  discrepancies  were  due  to  a 
programing  error  used  to  generate  the  list  provided  GAO.  Officials  at  Los 
Alamos  said  that  prior  to  our  request,  they  had  not  had  the  need  for 
such  data,  but  will  consider  adapting  their  current  computerized  system 
to  track  classified  contracts. 


OSS  Has  No  Written 
Review  Guidelines  and 
Directs  Limited  Resources 
to  FOCI  Reviews 


doe’s  oss  has  no  written  guidelines  for  reviewing  foci  questionnaires  and 
related  information  to  determine  whether  awarding  a  contract  poses  an 
unnecessary  risk  to  national  security.  The  completeness  and  thorough¬ 
ness  of  oss  reviews  depend  on  the  experience  of  the  individuals  con¬ 
ducting  the  review.  As  a  result,  foci  reviews  may  not  be  consistent  from 
contractor  to  contractor.  In  our  opinion,  written  guidance  would  provide 
for  more  consistent  reviews.  In  this  regard  we  noted  that  dod — which 
has  been  doing  foci  reviews  much  longer  than  doe — has  written  guide¬ 
lines  for  doing  such  reviews. 


Limited  resources  are  devoted  to  oss  foci  reviews.  At  headquarters,  for 
example,  until  August  1990,  only  one  staff  person  was  responsible  for 
investigating,  reviewing,  and  making  the  initial  foci  determination  for 
all  prospective  contractors  having  identified  foreign  interests — 40  for 
the  first  half  of  fiscal  year  1990.  In  an  attempt  to  ease  this  situation, 
headquarters  has  added  two  employees  to  work  full-time  on  the  foci 
review  group  and  is  in  the  process  of  hiring  a  foci  program  manager. 


foci  questionnaires  submitted  to  oss  are  often  inadequately  reviewed  by 
cognizant  field  safeguards  and  security  officials.  According  to  an 
internal  memorandum  from  the  Director,  OSS,  on  foci  guidance  and  feed¬ 
back,  the  majority  of  foci  questionnaires  submitted  to  headquarters 
from  field  units  were  inaccurate,  incomplete,  or  not  current.  Headquar¬ 
ters  has  been  completing  these  questionnaires  (contacting  the  company 
directly  to  obtain  the  deficient  information)  instead  of  returning  them  to 
the  field.  This  practice  increased  the  burden  on  headquarters  staff  and 
delayed  the  award  of  contracts.  Our  review  of  oss  foci  reviews  from 
June  1984  to  April  1990  for  which  sufficient  information  existed 
showed  that  they  required  an  average  of  4.5  months. 


Page  7 


GAO /RCED-9 1-83  Better  Foreign-Interest  Controls  Are  Needed 


B-221179.10 


Some  corrective  measures  were  taken  during  our  audit.  For  example,  in 
addition  to  hiring  extra  personnel  to  assist  in  oss  reviews,  oss  provided 
the  field  guidance  intended  to  ensure  that  foci  questionnaires  submitted 
to  headquarters  from  field  units  are  accurate,  complete,  and  current. 
According  to  an  OSS  official,  OSS  is  planning  several  fiscal  year  1992  foci 
training  courses  for  safeguards  and  security,  and  procurement 
personnel. 


DOE’s  FOCI  Questionnaire  The  foci  questionnaire  has  a  number  of  deficiencies.  First,  it  is  not 
Is  Deficient  designed  to  gather  relevant  information  for  individual  consultants. 

Although  doe’s  regulations  require  individual  consultants  to  disclose 
foreign  interests  when  completing  the  questionnaire,  the  questions  are 
not  directed  toward  gathering  appropriate  information  from  individual 
consultants.  For  example,  the  questionnaire  does  not  ask  whether  a  pro¬ 
spective  individual  consultant  is  now  or  has  ever  been  employed  by  or 
acted  as  a  consultant  for  a  foreign  government  or  firm. 

Second,  the  doe  questionnaire,  unlike  the  dod  questionnaire,  lacks  a 
deterrent,  such  as  dod’s  notice  on  penalties  for  making  false,  misleading, 
or  incomplete  statements.  According  to  doe  field  office  officials,  they 
relied  on  contractors  to  truthfully  disclose  their  foreign  interests  and 
provide  accurate,  current,  and  complete  responses  when  completing  the 
foci  questionnaire.  However,  as  the  oss  internal  memorandum  pointed 
out,  the  majority  of  the  questionnaires  submitted  to  headquarters  were 
inaccurate,  incomplete,  or  not  current.  We  believe  adding  a  penalty 
notice  similar  to  dod’s  would  help  minimize  incorrect  responses. 

Third,  the  questionnaire  does  not  ask  for  parent  firms’  identities. 
Although  doe  procedures  specify  that  the  foci  questionnaire  must  be 
submitted  by  the  company  doing  the  work  as  well  as  its  ultimate  parent 
corporation,  the  questionnaire  does  not  ask  the  company  that  completes 
the  form  to  identify  its  parent  company.  Consequently,  parent  compa¬ 
nies  have  not  always  completed  the  required  questionnaire.  To  deter¬ 
mine  the  extent  of  this  problem,  we  checked  Dun  and  Bradstreet  records 
for  29  of  the  90  companies  included  in  our  contractor  review  that 
answered  “no”  to  all  questions  and  had  not  provided  a  parent  company 
questionnaire.  We  determined  that  12  of  the  29  companies  had  undis¬ 
closed  parent  companies  that  should  have  prepared  a  foci  questionnaire. 


Conclusions 


doe  did  not  adequately  comply  with  its  regulations  and  procedures  for 
preventing  foreign  access  to  classified  information  or  material.  Because 


Page  8 


GAO/RCED-91-83  Better  Foreign-Interest  Controls  Are  Needed 


B-221179.10 


a  majority  of  the  contracts  we  reviewed  did  not  comply  with  these  pro¬ 
cedures,  we  believe  that  it  is  possible  doe  and/or  its  laboratories  might 
have  awarded  a  contract  that  could  pose  an  undue  national  security 
risk. 

While  the  laboratories  have  the  authority  to  award  contracts,  it  is  doe’s 
responsibility  to  ensure  that  the  laboratories  follow  doe’s  foreign- 
interest  procedures  before  awarding  these  contracts.  It  is  also  doe’s 
responsibility  to  follow  its  own  regulations  when  awarding  management 
and  operating  contracts  for  major  research,  production,  and  weapons 
facilities,  doe  has  fallen  short  of  meeting  these  responsibilities.  Further, 
doe’s  Albuquerque  and  San  Francisco  Operations  Offices,  responsible  for 
overseeing  foci  compliance  efforts  at  the  weapons  laboratories,  misinter¬ 
preted  the  regulations  and  did  not  follow  them. 

In  addition  to  compliance  problems  found  at  doe  and  its  weapons  labora¬ 
tories,  doe’s  foci  regulations  have  weaknesses  and  are  inconsistent  with 
those  of  most  other  federal  agencies.  The  regulations  need  strengthening 
because  they  do  not  require  safeguards  and  security  staff  members,  who 
are  in  a  better  position  to  identify  security  risks,  to  determine  whether 
an  undue  national  security  risk  exists  before  awarding  these  contracts. 
The  regulations  are  also  inconsistent  with  those  of  most  other  federal 
agencies,  causing  unnecessary  paperwork,  contract  delays,  and 
confusion. 

Finally,  doe  has  several  internal  control  weaknesses  that  could  result  in 
national  security  risks  by  permitting  foreign  access  to  classified  infor¬ 
mation.  One  such  weakness  is  that  the  foci  questionnaire  itself  does  not 
ask  appropriate  questions  of  prospective  individual  consultants. 


Recommendations 


To  increase  the  effectiveness  of  regulations  for  preventing  foreign 
access  to  classified  information  and  lessen  the  burdensome  nature  of 
foci  reviews,  we  recommend  that  the  Secretary  of  Energy  revise  doe’s 
acquisition  regulations  to  (1)  transfer  foci  determination  responsibility 
from  contracting  officers  to  oss  personnel,  (2)  require  a  foci  determina¬ 
tion  only  before  awarding  a  classified  contract  to  an  uncleared  company, 
and  (3)  require  all  cleared  contractors  working  with  classified  matter  to 
update  their  foci  information  as  directed  by  the  oss,  or  at  least  every  5 
years. 
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The  Secretary  should  also  take  the  following  measures  to  provide  more 
consistency  in  foci  regulations  govemmentwide  and  strengthen  doe’s 
foci  internal  controls: 

•  Explore  the  feasibility  of  entering  into  an  interagency  agreement  with 
dod  that  would  result  in  doe’s  acceptance  of  dod  foci  determinations. 

•  Require  management  and  operating  contractors  to  maintain  reliable 
computer-based  systems  that  identify  all  classified  contracts. 

•  Develop  written  guidelines  for  oss  reviews  of  foci  questionnaires. 

•  Revise  the  current  foci  questionnaire  to  include  additional  questions 
applicable  to  contracts  with  individual  consultants;  a  penalty  notice  on 
false,  misleading,  or  incomplete  statements;  and  a  requirement  to  iden¬ 
tify  all  affiliated  parent  companies. 


We  obtained  the  information  for  this  report  from  interviews  with  safe¬ 
guards  and  security  officials  and  procurement  officials  at  doe  headquar¬ 
ters,  operations  offices,  and  laboratories.  We  also  interviewed  dod 
officials  concerning  that  agency’s  foci  procedures.  We  reviewed  the  files 
of  classified  contracts  awarded  in  fiscal  years  1988  through  1990  at  the 
three  weapons  laboratories.  In  addition,  we  contacted  each  of  doe’s  oper¬ 
ations  offices  to  obtain  foci  compliance  information  on  all  existing  man¬ 
agement  and  operating  classified  contracts.  A  more  detailed  discussion 
of  our  objectives,  scope,  and  methodology  is  included  in  appendix  I. 

As  requested,  we  did  not  ask  doe,  dod,  or  the  laboratories  to  comment 
officially  on  this  report.  We  did,  however,  discuss  the  facts  in  this  report 
with  doe,  dod,  and  laboratory  officials  and  incorporated  their  views 
where  appropriate.  In  general,  they  agreed  with  the  facts  presented.  Our 
work  was  performed  between  December  1989  and  November  1990  in 
accordance  with  generally  accepted  government  auditing  standards. 

Unless  you  publicly  announce  its  contents  earlier,  we  plan  no  further 
distribution  of  this  report  until  30  days  from  the  date  of  this  letter.  At 
that  time,  we  will  send  copies  to  appropriate  congressional  committees, 
the  Secretary  of  Energy,  the  Secretary  of  Defense,  and  other  interested 
parties.  We  will  also  make  copies  available  to  others  upon  request. 


Page  10 


GAO/RCED-91-83  Better  Foreign-Interest  Controls  Are  Needed 


B-221179.10 


This  work  was  done  under  the  direction  of  Victor  S.  Rezendes,  Director, 
Energy  Issues,  who  can  be  reached  at  (202)  275-1441.  Other  major  con¬ 
tributors  to  this  report  are  listed  in  appendix  II. 


Sincerely  yours, 


Assistant  Comptroller  General 
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Objectives,  Scope,  and  Methodology 


On  October  25, 1989,  the  Chairman,  Senate  Committee  on  Governmental 
Affairs,  requested  that  we  determine  (1)  to  what  extent  the  Department 
of  Energy’s  (doe)  laboratories  purchase  weapons-related  and/or  dual 
use  components  or  technology  from  foreign  suppliers,  (2)  the  informa¬ 
tion  that  these  laboratories  provide  to  the  foreign  companies  (both 
directly  and  through  purchasing  agents),  (3)  the  type  and  level  of 
review  given  to  such  procurements  from  a  nonproliferation  and  tech¬ 
nology  transfer  standpoint,  and  (4)  the  extent  of  foreign  ownership  of 
U.S.  companies  that  do  business  with  doe’s  weapons  laboratories.1 

On  May  10,  1990,  we  briefed  the  Chairman’s  office  on  the  results  of 
audit  work  performed  at  four  doe  laboratories — Lawrence  Livermore, 
Los  Alamos,  Oak  Ridge,  and  Sandia.  Because  we  did  not  find  many  for¬ 
eign  procurements  at  the  laboratories  or  any  incidents  of  sensitive  infor¬ 
mation  provided  to  foreign  companies,  but  did  find  problems  with  doe’s 
procedures  to  identify  and  protect  against  situations  in  which  the  for¬ 
eign  ownership,  control,  or  influence  over  doe  contractors  or  subcontrac¬ 
tors  may  pose  security  concerns,  we  agreed  to  concentrate  our  efforts  on 
the  foreign-ownership  issue.  Specifically,  we  agreed  to  review  the  extent 
of  compliance  with  doe’s  contracting  procedures  designed  to  protect 
against  an  undue  risk  to  the  common  defense  and  security  of  the  United 
States  when  awarding  classified  contracts.2  Such  risk  may  result  if  clas¬ 
sified  information  or  significant  amounts  of  special  nuclear  material  are 
made  available  to  contractors  or  subcontractors  who  are  foreign  owned, 
controlled,  or  influenced  (foci)  by  foreign  governments,  individuals,  or 
organizations. 

To  obtain  information  on  doe’s  compliance  with  its  own  foci  require¬ 
ments  in  awarding  long-term  management  and  operating  (m&o)  contracts 
to  companies  that  operate  doe’s  major  facilities,  we  contacted  each  of 
doe’s  eight  operations  offices  at  the  following  locations:  Albuquerque, 
New  Mexico;  Argonne,  Illinois;  Idaho  Falls,  Idaho;  Las  Vegas,  Nevada; 
Oak  Ridge,  Tennessee;  Richland,  Washington;  Oakland,  California;  and 
Aiken,  South  Carolina.  We  reviewed  a  copy  of  the  foci  questionnaire 
submitted  by  the  contractor  as  well  as  its  parent  or  holding  company, 
and  documentation  showing  the  date  of  contract  award  for  the  existing 


1  DOE’s  Lawrence  Livermore  National  Laboratory  located  in  Livermore,  Calif.;  Los  Alamos  National 
Laboratory  located  in  Los  Alamos,  N.M.;  and  Sandia  National  Laboratory  located  in  Albuquerque, 
N.M.,  sire  referred  to  as  weapons  laboratories. 

Classified  contracts  are  those  that  require  access  to  classified  information  or  significant  quantities  of 
special  nuclear  materials.  Special  nuclear  material  is  material  that  can  be  used  to  manufacture 
nucleEir  weapons.  “Significant  quantities”  of  this  material  is  defined  in  10  C.F.R.  Part  710. 
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contract.  Because  the  universe  of  m&o  contracts  requiring  foci  proce¬ 
dures  was  small — only  37  out  of  a  possible  51  total  m&o  contracts — we 
reviewed  all  37  contracts. 

We  also  contacted  laboratory  pr  ,curement  officials  and/or  safeguards 
and  security  officials  at  the  Lawrence  Livermore,  Los  Alamos,  and 
Sandia  National  Laboratories  to  gather  information  on  foci  procedures 
used  by  the  laboratories  and  to  request  a  list  of  classified  contracts 
awarded  from  October  1, 1987,  through  March  31, 1990,  to  determine 
whether  the  laboratories  were  complying  with  doe’s  foci  requirements. 

•  Livermore  officials  identified  82  classified  contracts  awarded  from 
October  1987  through  July  1990.  We  excluded  12  contracts  that  were  (1) 
awarded  to  M&o  contractors  and/or  M&o  parent  companies  because  these 
companies  were  examined  in  our  review  of  doe’s  compliance  with  its 
own  foci  requirements  in  awarding  long-term  m&o  contracts  and  (2) 
awarded  after  March  31, 1990.  Of  the  remaining  70  contracts,  18  for 
fiscal  year  1988,  29  for  1989,  and  23  for  1990,  we  reviewed  a  random 
selection  of  38  or  54  percent. 

•  Los  Alamos  officials  identified  362  contracts  that  they  said  possibly 
involved  classified  matter  for  this  time  period.  These  officials  were 
unable  to  provide  us  a  list  of  classified  contracts  because  they  lacked  a 
system  designed  to  identify  such  contracts.  To  determine  whether  a  con¬ 
tract  on  the  list  required  access  to  classified  matter,  we  reviewed  the 
contract  file.  We  excluded  213  contracts  that  were  (1)  contracts 
awarded  to  m&o  contractors  and/or  M&o  parent  companies,  (2)  contracts 
awarded  after  March  31, 1990,  or  before  October  1, 1987,  (3)  duplicate 
contracts  already  identified  in  other  fiscal  years,  and  (4)  contracts  with 
government  agencies.  Of  the  remaining  149  contracts,  81  for  fiscal  year 
1988,  44  for  fiscal  year  1989,  and  24  for  fiscal  year  1990,  we  reviewed 
all  but  one  fiscal  year  1989  contract  (Los  Alamos  officials  were  unable 
to  locate  one  contract),  all  1990  contracts,  and  a  random  selection  of  41, 
or  51  percent  of,  fiscal  year  1988  contracts. 

•  Sandia  officials  identified  451  classified  contracts  for  this  period.  We 
excluded  194  contracts  that  were  (1)  awarded  to  M&o  contractors  and/or 
M&o  parent  companies,  (2)  awarded  to  government  agencies  because 
these  do  not  require  foci  procedures,  and/or  (3)  unclassified  contracts 
that  had  inadvertently  been  included  on  the  list.  Of  the  remaining  257 
contracts,  60  for  fiscal  year  1988, 126  for  1989,  and  71  for  1990,  we 
reviewed  a  random  selection  of  131,  or  51  percent. 

We  reviewed  each  contract  file  to  determine  whether  access  to  classified 
matter  was  required,  and,  if  so,  whether  (1)  the  contractor  completed 
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the  foci  questionnaire  or  certified  that  it  had  previously  answered  the 
foreign-interest  questions  and  (2)  the  doe  contracting  officer,  after  con¬ 
sulting  with  doe’s  Office  of  Safeguards  and  Security  (oss)  or  the  cogni¬ 
zant  field  safeguards  and  security  director,  had  made  a  foreign-interest 
determination  before  awarding  the  contract. 

To  examine  whether  all  classified  contracts  had  been  identified,  we 
reviewed  facility  data  and  approval  records  (fdar)  maintained  at  doe’s 
San  Francisco  and  Albuquerque  Operations  Offices’  safeguards  and 
security  divisions.  Although  the  fdar  did  not  provide  complete  informa¬ 
tion  on  all  classified  contracts,  it  served  as  a  rough  means  to  check  the 
completeness  of  the  information  provided  by  the  weapons  laboratories 
on  classified  contracts.  We  identified  47  contracts  requiring  foci  proce¬ 
dures  that  were  not  identified  by  the  laboratories.  Twenty  of  these  con¬ 
tracts  should  have  been  included  on  Livermore’s  original  list,  but 
because  of  time  constraints  we  were  unable  to  include  these  files  in  our 
statistical  sample  of  contracts  reviewed  for  compliance  with  foci  proce¬ 
dures.  The  remaining  27  contracts  should  have  also  been  included  on 
Sandia’s  original  list  and  were  added  to  that  list  before  we  took  our  sta¬ 
tistical  sample.  As  a  result,  16,  or  59  percent,  of  these  contracts  were 
selected  for  our  review  for  compliance  with  doe’s  foci  requirements. 
Nevertheless,  our  review  of  the  weapons  laboratories’  computerized 
data  systems  was  limited  to  testing  the  reliability  of  the  data  system.  We 
did  not  determine  the  cause  of  any  deficiencies  found. 

We  also  reviewed  files  maintained  by  doe’s  oss  on  companies  that  had 
responded  with  at  least  one  “yes”  to  their  foci  questionnaire,  oss  offi¬ 
cials  provided  us  a  list  of  202  companies,  from  which  we  excluded  15 
companies  that  were  M&o  contractors  and/or  M&o  parent  companies  and 
1  company  file  oss  could  not  locate.  Of  the  remaining  186  companies,  we 
reviewed  a  random  selection  of  78,  or  42  percent,  to  determine  (1)  the 
extent  and  type  of  foreign  interest,  (2)  the  average  time  doe  takes  to 
make  an  foci  determination,  and  (3)  how  often  oss  decided  it  was  neces¬ 
sary  to  recommend  that  the  cognizant  doe  contracting  officer  impose 
restrictions  on  prospective  or  existing  contractors  to  mitigate  security 
risks. 

To  obtain  information  on  doe’s  foci  process  and  how  it  compares  with 
the  Department  of  Defense’s  (dod)  procedures,  which  are  followed  by 
most  other  agencies,  we  contacted  (1)  doe  headquarters  officials  at  the 
Office  of  General  Counsel  and  at  oss  and  (2)  dod  officials  at  the  Office  of 
Industrial  Security  and  at  the  Defense  Investigative  Service.  We 
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reviewed  doe’s  acquisition  regulations  setting  forth  the  broad  foci  poli¬ 
cies  and  requirements  for  contractors,  and  oss’  specific  procedures  for 
reviewing  foci  submissions,  to  determine  doe’s  regulations  and  proce¬ 
dures  for  obtaining,  reviewing,  and  making  foci  determinations.  We  also 
reviewed  dod’s  Industrial  Security  Manual  for  Safeguarding  Classified 
Information  and  applicable  excerpts  of  its  Industrial  Security  Regula¬ 
tions  addressing  dod’s  foci  policies  and  procedures. 

Since  we  developed  our  estimates  using  a  sample  (called  a  probability 
sample)  of  classified  contracts  awarded  by  the  weapons  laboratories  and 
files  maintained  by  oss  on  companies  that  had  responded  with  at  least 
one  “yes”  to  their  foci  questionnaire,  each  estimate  has  a  measurable 
precision  called  a  sampling  error,  which  may  be  expressed  as  a  plus  or 
minus  figure.  A  sampling  error  indicates  how  closely  we  can  reproduce 
from  a  sample  the  results  that  we  would  obtain  if  we  were  to  take  a 
complete  count  of  the  universe  using  the  same  measurement  methods. 

By  adding  the  sampling  error  to  and  subtracting  it  from  the  estimate,  we 
can  develop  upper  and  lower  bounds  for  each  estimate.  This  range  is 
called  a  confidence  interval.  Sampling  errors  and  confidence  intervals 
are  stated  at  a  certain  confidence  level — in  this  case,  95  percent.  For 
example,  a  confidence  interval,  at  the  95-percent  confidence  level, 
means  that  in  95  out  of  100  instances,  the  sampling  procedures  we  used 
would  produce  a  confidence  interval  containing  the  universe  value  we 
are  estimating.  In  one  instance,  a  slightly  different  estimating  technique 
was  used.  This  technique  does  not  provide  symmetric  confidence  inter¬ 
vals.  Table  1.1  through  1.3  show  the  results  of  our  review  of  contract 
files  at  each  of  the  weapons  laboratories  used  in  our  probability  sample. 
Table  1.4  shows  the  statistical  estimates  used  in  this  report  and  their 
associated  confidence  intervals. 


at  Lawrence  Livermore  National 

Fiscal  vear 

Laboratory  Contracts 

1988 

1989 

1990 

Total 

Total  universe 

18 

29 

23 

70 

Sample  size 

13 

14 

11 

38 

In  compliance 

0 

0 

0 

0 

Not  in  compliance 

13 

12 

5 

30 

Not  applicable 

0 

2 

6 

8 

No  FOCI  questionnaire3 

0 

1 

0 

1 

included  in  "not  in  compliance”  values. 

Source:  GAO  review  of  Lawrence  Livermore  classified  contracts. 
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Table  1.2:  Results  of  Contracts  Reviewed 

at  Los  Alamos  National  Laboratory  _ Fiscal  year 


Contracts 

1988 

1989 

1990 

Total 

Total  universe 

81 

44 

24 

149 

Sample  size 

41 

43 

24 

108 

In  compliance 

1 

0 

0 

1 

Not  in  compliance 

12 

21 

18 

51 

Not  applicable 

28 

22 

6 

56 

No  FOCI  questionnaire3 

2 

1 

1 

4 

included  in  "not  in  compliance"  values. 

Source:  GAO  review  of  Los  Alamos  classified  contracts. 

Table  1.3:  Results  of  Contracts  Reviewed 

at  Sandia  National  Laboratories  _ Fiscal  year 


Contracts 

1988 

1989 

1990 

Total 

Total  universe 

74 

136 

74 

284 

Sample  size 

38 

69 

40 

147 

In  compliance 

1 

1 

1 

3 

Not  in  compliance 

37 

68 

37 

142 

Not  applicable 

0 

0 

2 

2 

No  FOCI  questionnaire3 

4 

11 

11 

26 

included  in  "not  in  compliance"  values. 

Source:  GAO  review  of  Sandia  classified  contracts. 

Associated  95-Percent  Confidence 

Interval  bounds 

Intervals 

Description  of  estimate 

Estimate  Lower  Upper 

Contracts  subject  to  FOCI  procedures 

79% 

77% 

81% 

Contracts  not  complying  with  FOCI 

98 

97 

99 

Contracts  without  a  FOCI  questionnaire 

14.5 

11.5 

17.5 

Contracts  requiring  a  proxy  agreement3 

1.3 

0.3 

5.6 

Average  OSS  FOCI  processing  time  in  months 

4.5 

3.9 

5.1 

aUnder  a  proxy  agreement,  foreign  owners  appoint  U.S.  citizens  proxy  holders,  who  have  the  same 
rights  and  authority  as  stockholders. 

Source:  GAO  analysis  of  contract  and  OSS  reviews. 


We  discussed  the  facts  in  this  report  with  doe,  dod,  and  weapons  labora¬ 
tory  officials  and  incorporated  their  views  where  appropriate.  As 
requested,  we  did  not  ask  doe,  dod  or  the  laboratories  to  comment  offi¬ 
cially  on  this  report.  Our  work  was  performed  between  December  1989 
and  November  1990  in  accordance  with  generally  accepted  government 
auditing  standards. 
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Appendix  II _ _ 

Major  Contributors  to  This  Report 


Resources, 
Community,  and 
Economic 

Development  Division, 
Washington,  D.C. 


Judy  A.  England-Joseph,  Associate  Director 

Robert  E.  Allen,  Jr.,  Assistant  Director 

David  A.  Rogers,  Assistant  Director  Design,  Methodology,  and 

nical  Assistance 

Ronald  E.  Stouffer,  Assignment  Manager 
Michael  S.  Sagalow,  Evaluator-in-Charge 


Tech- 


Denver  Regional 
Office,  Albuquerque 
Suboffice 


John  D.  Gentry,  Regional  Management  Representative 
Christopher  Pacheco,  Regional  Assignment  Manager 
Sarah  A.  Narvaez,  Staff  Evaluator 


(301908) 
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